BVwG - W274 2246355-1

BVwG - W274 2246355-1
Court:	BVwG (Austria)
Jurisdiction:	Austria
Relevant Law:	Article 5(1)(c) GDPR Article 6(1)(f) GDPR
Decided:	22.12.2021
Published:	18.01.2022
Parties:	anonymous DSB (Austria)
National Case Number/Name:	W274 2246355-1
European Case Law Identifier:	ECLI:AT:BVWG:2021:W274.2246355.1.00
Appeal from:
Appeal to:
Original Language(s):	German
Original Source:	Rechtsinformationssystem des Bundes (RIS) (in German)
Initial Contributor:	Heiko Hanusch

The Federal Administrative Court held that a cleaning company did not violate the principle of dataminimisation by notifying a property management company it worked with that one of its cleaners was laid off.

English Summary

Facts

The controller is the owner of a building cleaning company. The data subject worked for the controller as a cleaner in several buildings for about three to four years. The data subject also had lived in one of these buildings. In October 2019 the data subject was let go by the controller. After the termination of the employment contract, the controller informed the property management that the data subject was no longer employed and new cleaning staff would take over his role. The controller did not mention which party terminated the employment. About one and half years later, the data subject became aware of the exchange between their former employer and the property management company. As a consequence, a legal action was started.

Holding

The court determined that the controller neither violated the data minimisation principle of Article 5(1)(c) GDPR nor acted unlawfully under Article 6 GDPR. Even though the contract did not stipulate an obligation to inform the property management of a change in the cleaning staff, the court concluded that the controller pursued a legitimate interest which was not overridden by the interests of the data subject (Article 6(1)(f) GDPR). In the eyes of the court, the determining facts were:

• The personal element involved in the cleaning of buildings;
• The small business dimension of the controller providing a personal service to its customers;
• The data subject living in one of the buildings of the complex where they used to work;
• The information of the termination of the employment contract being essentially non-sensitive and unbiased without any pejorative meaning.

Concerning Article 5(1)(c) GDPR the court specified that the minimisation principle is not violated if it is not possible to remove any further data without making it more difficult to achieve the purpose. Phrased reversely: the principle is violated if one can remove information without making it more difficult to achieve the purpose.

Comment

The court did not make any further statement regarding Article 5(1)(c) GDPR. Taking the above reasoning into account, it seems that it deemed the act of informing the property management on the change in cleaning staff necessary for the running of a small building cleaning business.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

                                                                          Postal address:
                                                                 Erdbergstrasse 192 – 196
                                                                           1030 Vienna
                                                                    Phone: +43 1 601 49-0
                                                             Fax: +43 1 711 23 – 889 15 41

                                                           Email: einlaufstelle@bvwg.gv.at
                                                                       www.bvwg.gv.at



                  DECISIONS D A T U M
                              2 2 . 1 2 . 2 0 2 1

                          BUSINESS NUMBER





                    W 2 7 4 2 2 4 6 3 5 5 - 1/2 0 E



               I M N A M E N D E R E P U B L I K !


The Federal Administrative Court recognizes Mag. LUGHOFER as chairman through the judge

as well as the expert lay judges Prof. KommR POLLIRER and Dr. GOGOLA as assessor
about the complaint of Ing.XXXX, represented by LTRA RechtsanwälteDr.MartinLEITNER,

dr Ralph TRISCHLER, Dr. Peter KRAUS, BSc. and dr Bernhard HOFMANN, Lindengasse 38/3,

1070 Vienna, against the decision of the data protection authority, Barichgasse 40-42, 1030 Vienna, dated
08/11/2021, GZ. D124.3842, collaborators XXXX , for violation of the right to

Confidentiality, rightly so after a public hearing:


The complaint will be followed and the disputed decision will be amended to the effect that
that his saying is:


"The appeal is dismissed."


The revision is not permitted according to Art. 133 Para. 4 B-VG.





                          Reasons for decision:


With a complaint sent by e-mail to the data protection authority on March 23, 2021 (im

Hereinafter: authority concerned) claimed XXXX (hereafter: co-participants, MB) a
Violation of the right to secrecy by "Ing.XXXX" (hereinafter: complainant,

BF) and argued that the cleaning company " XXXX , owner Ing. XXXX " was former, - 2 -


Employer of the MB and look after a residential complex in which she lives. The MB got themselves
in a collective complaint from dissatisfied tenants to the property management or the

tenants' association, which resulted in a letter from the property management

in which it is mentioned that the MB was employed by the BF and that on the part of the BF
employment had been terminated. The BF just gave you this information

Clerk of property management XXXX leaked, increasing the credibility of

MB will be questioned and what the property management does not concern. The BF have thereby
breach their duty of confidentiality and the fundamental right to secrecy.


Enclosed was an e-mail from XXXX to XXXX with another recipient in Cc dated

March 9th, 2021, which also contains the following sentence:

"I would also like to note that your client was employed by the company XXXX,

However, the employment relationship (on the part of the XXXX company) with her client was terminated

would".

Upon request, the BF initially stated in an email dated April 8, 2021 that he could

Complaint letters do not recognize a violation of the GDPR, they are not data

processed nor passed on. The property management have the data of the MB
necessarily because she lives and works there. MB already employs many

Employees of the authority concerned (hereinafter referred to as the BF several business figures
apparently the authority concerned). There is also a question for the relevant authority as to whether

have no possibility of imposing penalties in the event of obvious abuse or

to charge expenses.

With a second request, the authority concerned turned to the BF and asked him

to announce whether the statement should be understood in such a way that the BF

Management of the MB not about the fact that the MB had been terminated,
have informed.


In a further statement by email dated May 6th, 2021, the BF stated that he had the

Property management not informed that the MB had been terminated/dismissed, but have
he has a duty to inform his customers about a change in personnel and the departure of a

To inform an employee who had free access to his property in order to

Customers given the opportunity to change the locks or a ban on entry
to impose if he deems it necessary. Also in the enclosed letter from

Property management is informed of a "dissolved employment relationship" and no "termination"
or "dismissal" spoken., - 3 -


This letter was sent to the MB to be heard by the parties.

In an email dated May 16, 2021, MB initially referred to the letter dated March 9, 2021

regarding the notification of the termination of the employment relationship (by the BF). be it

an absolute no-go if the (also former) employer with personal
peddle stories. The BF gave two pieces of information, namely the

Termination of the MB by him and the address of the MB. The question arises why the

mentioned information in 2021 for the lessor/business partner of the BF
represented important information if the MB had already left the company in 2019.

It was the BF's right to demand that the cleaning work be carried out in relation to the amount of the

To justify operating costs, but this must be done differently, such as by
logged notes regarding the presence of the respective employees, but not with

the data of the MB. The BF discredited the person of the MB.


Attached to the statement was, among other things, a confirmation of the
Key handover from the MB to the BF on October 28th, 2019.


With the contested decision, the relevant authority upheld the complaint and filed

determined that the BF had violated the MB's right to secrecy by
Property management about the termination of the existing between him and the MB

informed of the employment relationship.

The authority concerned established the following facts (the designations of the parties

have been adapted to the complaints procedure):


"1. The BF is the owner and managing director of the company " XXXX ".

2. There was an agreement between the MB and the company "XXXX" operated by the BF

Employment relationship, which was terminated by the BF in October 2019 by notice. the

MB returned all of her to the BF in October 2019 as part of her employment
handed out key.


3. The MB was with the BF as a cleaner until the end of the employment relationship

employed, with the company of the BF for the care of the housing complex with the
Address XXXX where the MB resides.


4. In December 2020, MB and other tenants of the in question resigned

Residential complex as part of a collective complaint to their property management "XXXX
Non-profit housing and settlement cooperative GmbH”., - 4 -


5. The BF informed the named property management at an unspecified point in time
about the fact that the employment relationship between him and the MB has been terminated.


6. A clerk from the housing association then contacted the

Residential community of property XXXX with the following letter:

Dear Mag. XXXX!


With reference to correspondence, among other things, we would like to inform you that in the contract

unfortunately a careless mistake must have been made. The exact address of the property is
XXXX (there used to be a staircase 3) - we will fix these mistakes as soon as possible

correct. Furthermore, on our part (after receipt of the first complaints -

mainly from Mrs. XXXX and Mr. XXXX ) just in November/December 2020
several personal inspections and checks (incl. photo documentation) carried out

no serious misconduct or breach of duty could be determined - the

WHA or the stairwell was always cleaned/cared for
found. Due to the fact that continues (in our opinion unfounded)

Complaints were received, the tenant survey included in the supplement

accomplished. From 31 interviewed main tenants, we have enclosed 4 negative ones
get feedback. Then the "problem" with the care company

discussed or even exchanged the staff for the housing complex.

As you correctly pointed out, due to the retirement of HB-alt, it has one

Tender for house cleaning and maintenance cleaning given in 2016

(Best and cheapest bidder XXXX).
€ 14,500 (same as in 2013 and 2014 - almost the same amounts)

dejected. From 2017 - the first full accounting year of the company XXXX - were annually

€ 8,450.00/net charged over the operating costs. I.e. it could for the
Residents massive savings can be achieved. The costs have increased due to the

Index adjustment increased to €9,227.08/net annually in 2020.


We would also like to note that your client was employed by the company XXXX,
however, the employment relationship (on the part of the company XXXX) with your client was terminated

… . For the reasons mentioned above, we can accept the complaints on the part of you

client cannot be traced. We will, however, again with the
Contact the management of the company XXXX and the "specifications" exactly

discuss it through or give instructions to work even more precisely., - 5 -


Kind regards
 XXXX


property management"


Legally, the authority concerned came to a conclusion based on the provisions of Section 1 (1).
DSG as well as Art. 5 Para. 1 lit. c and Art. 6 Para. 1 lit. f DSGVO, the processing is based on

Legitimate interest basis and three cumulative conditions allowed:
Perception of a legitimate interest by the person responsible or the person(s).

Third parties to whom the data have been communicated; Necessity of processing

personal data for the realization of the legitimate interest and no
Predominance of the fundamental rights and freedoms of the data subject

about the perceived legitimate interest.


The disclosure of the fact of the termination of the employment relationship between the BF
and the MB does not serve any legitimate interests of the MB that override the interests of the MB

BF or other third party. The statements of the BF, according to which he was only doing his duty

would have perceived towards his customer, did not catch, especially after more general
Life experience is not to be assumed that his property management over each individual

Change of staff within the cleaning staff who are cleaning by her

managed properties entrusted to be informed. In addition, disclosure is sufficient
of the personal data of the MB with regard to the fact that the MB after leaving

the employment relationship, all keys handed over to the BF as part of this
have returned, nor the principle of data minimization according to Art. 5 Para. 1 lit. c

GDPR.


The BF's complaint, raised by a lawyer, is directed against this decision
primary application, after conducting an oral hearing, the decision

to be amended so that the application is rejected by MBab-or.Because the MB

already at the end of 2019 knowledge of the notification that she considers to be the subject of the proceedings
the application to initiate the procedure was time-barred on March 23, 2021 in accordance with Section 24 (4) DSG

and the complaint already rejected or dismissed on that basis. Moreover, the BF

a legitimate interest in maintaining its good economic reputation, which is endangered,
if the MB continues to be in contact with the property management or the other roommates

name of the BF or his company. The balancing of interests to be carried out

against this background must clearly be in favor of the BF., - 6 -


The authority concerned submitted the disputed decision and the electronic one
Administrative act before the administrative court, received on September 14th, 2021.


The complaint was made by the MB by the administrative court on September 21, 2021 for any statement

in particular with regard to the objection to the time limit.

The MB commented on October 3, 2021 as follows:


It is not correct to claim that the MB was already aware of it at the end of 2019,

that the BF brought the information to XXXX. If that had been the case, she would have
insisted that this notification be sent to her in writing. It did though

phone calls, but they always made sure that her family, her lawyer

and she herself had been insulted. But if the statement of the BF is correct, the MB is
already announced at the end of 2019, the question arises as to why this was not the case

data protection authority was discussed. To terminate the employment relationship

The MB also stated through the BF that she herself was in possession of a house gate key
The cellar break-in mentioned happened in 2013 and affected her own cellar. It

is not necessary to inform XXXX about the termination of the employment relationship by the BF in

To let the tenants know so that the property manager would know who to contact
concerns could address. One could also trust her to make this correction herself. she

will never pretend to be an employee after the end of the employment relationship
MB on September 8th, 2021 via WhatsApp an offer regarding stairwell care

leave.


The MB sent in the attachment “the entire WhatsApp history and
Memory protocols” and offered their interrogation as evidence.


On October 25, 2021, extensive additional documents were submitted as "supplement to the statement".

of the MB, including an application for approval of legal aid "to represent the
MB at the hearing by a lawyer as well as expenses and travel expenses” and

an attached statement of assets.


This application for legal aid was logged for GZ 2246355-2 and will be used as a separate file
guided.


With a submission dated November 12, 2021, the MB also submitted that meanwhile it was under theirs

Vehicle has been found by her auto mechanic, taking herself a "GPS tracker".
turned out that, according to information from the XXXX customer service, the SIM card that is in the

GPS found on which BF is registered. As a result, the private life of the MB and her - 7 -


Husband massively impaired, as well as their personal rights. A report from both police
had been brought in.


A letter from the relevant authority was also sent to the administrative court on November 12, 2021

with which they submit an entry to the MB from November 10th, 2021 "for information". This
Input from November 10th, 2021 refers in turn to the “GPS tracker” mentioned.


On November 18, 2021, a public oral hearing took place before the Federal Administrative Court

Negotiation took place in which the BF and the MB were heard as parties. further
After being instructed in this regard, the MB's application for approval of the

Legal aid dismissed and through this to the execution of the decision and appeal

waived.

The following facts are certain:


The BF operates as a sole trader in XXXX a pest control and

Building cleaning company and employs cleaning staff on a small scale
totaling about three and a half full-time employees.


The BF and MB have known each other for about eight years.

The MB lives in a community housing complex comprising seven stairwells

Municipality XXXX at address XXXX

“, with which the BF has a home care contract.

The MB was for about three or four years at the BF with about 20 hours a week as a caretaker

entrusted with the cleaning of the seven stairwells of the said facility XXXX. she

did the cleaning there personally, except during her vacation time.

The BF is of the opinion that the MB in the course of their work for the BF at a

made other customers guilty of "working time fraud". According to the BF's point of view

unsuccessful attempts to reach a solution with the MB while maintaining the employment relationship
come, this dissolved the employment relationship with the MB on October 25, 2019. One came

Key handover. Since then, MB has only had keys for the staircase

1.

Immediately after the end of the employment relationship with the MB, the BF informed the long-standing

Housekeeping staff "XXXX, with, the BF now has someone new for you

Supervision of the housing complex mentioned, the MB is no longer employed by the BF., - 8 -


In connection with a complaint problem because of their opinion
insufficient cleaning of the staircase from about July 2020, the MB came to the

tenants' association and had contact with a Mr. XXXX there. As part of an in

this connection between the property management "XXXX" and the tenants' association
conducted correspondence, XXXX XXXX sent the e-mail shown in the procedure above

Mail dated March 9th, 2021, which reads, among other things:


"We would also like to note that your client was employed by the company " XXXX ",
However, the employment relationship (on the part of the company "XXXX") with your client was terminated

would."


The MB became aware of this e-mail on March 9th, 2021. It could not be determined
that the MB was already aware that the BF had called the property management "XXXX"

informed of their departure.


The BF shared the fact that the MB was no longer employed by him
Property management "XXXX" in particular because he considers it "professional"

looked at. There is an obligation to notify the specific employee change

from the caregiving contract between "XXXX" and the BF.

It could not be determined that the MB after leaving the service of the BF

continued to act as caretaker of the XXXX residential complex.

The MB feels the notification of the termination of their employment relationship to "

XXXX " especially as disadvantageous because they live in the complex, some of

need property management and she considers her credibility to be questioned by XXXX.

There are several procedures between the parties - on the initiative of the MB - in particular

a regional court as a labor and social court, before a tax office and before the

Data Protection Authority pending.

                                    Evidence assessment:


The circumstances of the place of residence and the employment relationship of the MB to the BF were

presented in a credible manner and the result is not disputed. Also the information of the BF to
date of termination of employment are credible.


The BF also presented the fact that the MB no longer worked for him in the

determined form (accordingly, this determination was already made by the authority concerned) and, - 9 -


determined point in time credibly. The same applies to the motives mentioned by him
this notice. There was no evidence to the contrary. The fact that that

e-mail written by the XXXX about one and a half years after this notification

the information includes that the employment relationship was terminated by " XXXX " is already
due to the temporal component, there is no compelling indication that the original

notification of the BF also included this circumstance.


Although the BF, in particular in the context of the complaint, alleged circumstances that
then worked, the MB continued to work as an employee after she left

cleaning service issued in the mentioned facility, these proved to be true within the framework

of the evidential process in any way. The BF was unable to give specific circumstances
describe the MB's inappropriate behavior in relation to their previous service

closed for the BF in the house she lives in.


The content of the message from property management by XXXX to the employee of
Tenant Association is evidenced by the reproduced e-mail expression.


The MB stated credibly that it was a notification from the past

of the BF to the property management, the MB no longer works there, only through this e-
to have found out by mail. The BF did not succeed in making the circumstances understandable

indicate an earlier date of this notification.Specific circumstances regarding a
The telephone conversation alleged in this regard did not come out.


                                      Legally follows:


With regard to the objection to a time limit pursuant to Section 24 (4) DSG, the BF is initially entitled to the determination
refer to, according to which the e-mail to which the MB referred in its complaint to the

authority related, this came to the attention of 09.03.2021, which cannot be determined

could that the MB had previously known that the BF the property management "
XXXX " had informed about their departure. Based on this, the complaint is dated

23.3.2021 not late at all.


In the matter:

According to Art. 5 Para. 1 lit. c GDPR, personal data must be appropriate for the purpose

and substantial and limited to what is necessary for the purposes of the processing

(“data minimization”)., - 10 -


Data minimization is the principle of reducing the processing of personal data
data on the inevitable.


The first requirement of data minimization asks whether the data serves the purpose

are appropriate. This applies if the processing of the data is not for the respective purpose
can already be objected to within the framework of an objective evaluation.


Furthermore, the relevance is to be checked

conducive, i.e. suitable within the framework of the fundamental legal doctrine of proportionality.
Is it possible to imagine the processing of certain data without the

achievement of purpose is made more difficult, then these are not significant.


(Hötzendorfer/Tschohl/Kastelitz in Knyrim, Datkomm Art. 5 GDPR, para. 34 ff ).

According to Art. 6 Para. 1 DSGVO, the processing is only lawful if at least one of the

the following conditions are met:


The following condition can be found under lit. f: The processing is to safeguard the
legitimate interests of the person responsible or a third party, unless required

Interests or fundamental rights and freedoms of the data subject requiring protection

require personal data, especially when it comes to the
data subject is a child.


Only lit. f comes into question: that of the ECJ for the previous provision
developed “test scheme”.


1. the existence of a legitimate interest by which for the processing

responsible is perceived,

2. the necessity of processing personal data to achieve the

legitimate interest and


3. no predominance of the fundamental rights and freedoms of the data subject. At its core is
to weigh up the interests affected in each individual case

(Kastelitz/Hötzendorfer/Tschohl in Knyrim, DatKomm Art. 6 GDPR, para. 51).


In principle, the relevant authority already considered the two aforementioned to be right
provisions relevant. She came to the view, however, after more general

Life experience cannot be assumed that his property management over each individual

Personnel changes within the cleaning staff who are cleaning the - 11 -


managed properties entrusted to be informed. Especially in view of that
the MB after leaving the employment relationship all the keys handed over to them

returned, the disclosure does not satisfy the principle of data minimization.


On the basis of the now supplementary findings, the administrative court comes to a conclusion
other result of the balancing of interests:


First of all, based on the findings made, it can be assumed that a very

personalized service by the MB for the BF and thus to the
Property management and the residents took place, especially since the MB, apart from times of

vacation, person did the house cleaning of all seven stairwells in person and

moreover due to the fact that she lives in one of the houses belonging to the complex,
there is also a personal close relationship. This is opposed to the fact that the

BF's company is a very small company and so is he as a result

strives to provide “personal services”. As noted, the BF shared -
regardless of the disputed reasons for the termination of the employment relationship - the long-term

Contact person on the part of the contractual partner, the property management " XXXX ", only with,

that the MB at that time no longer carried out the house cleaning of the mentioned facility
distinguished, but someone else. Only this communication is to be judged, but not

which are the responsibility of another person responsible, the " XXXX "
Composition of the e-mail from 09.03.2021. Even if due to the established

content of the contract, there is no obligation on the part of the BF to notify the contractual partner of the change of

In the opinion of the administrative court, there is an obligation to announce the cleaning staff
legitimate interest of the BF as a small business owner, in the specific context presented above

to inform the property management of the change of the specific cleaning staff, this

especially against the background that the MB is also a resident
of the said facility. For the reasons mentioned, one will also

the necessity of processing this data.


The MB considered this communication, in particular in connection with it
Subsequent notification by the property management to the tenants' association, as

discriminatory and questioning their credibility.


In this context, the MB should be pointed out that the responsibility of the
BF is not only limited to the message he sent to the property manager

any other notifications that may result from this. The circumstance - 12 -


the termination of the employment relationship itself is considered neutral factual and not sensitive

View date without rating content.

From the point of view of the property management towards the MB as a resident of the building

there are therefore no comprehensible reasons for the said notification

appear to be discriminatory or pejorative.

Overall, the administrative court assumes that the interests of the BF predominate

compared to those interests of the MB, which means that the legality of the

Data processing (through verbal transmission of information) is given. Can you
thinking away no further data without making it more difficult to achieve the purpose is also

a violation of the principle of data minimization is not evident.


The complaint of the BF was therefore to be followed and the ruling of the contested decision
to change in a negative sense.


It is also stated that the notifications from the MB regarding any

Data protection violation by the BF through the attachment of a completely new GPS tracker
character, are therefore not to be dealt with in the context of this complaint and, at most, for

could be the subject of a new privacy complaint.


The statement of the inadmissibility of the revision follows the fact that based on the
provisions of the GDPR, individual assessments were to be carried out.